Knip CVE-2026-120325

Exploitation requires a victim to run Knip's autofix/IssueFixer path (the writeFile routine) against a project whose Knip configuration supplies an attacker-controlled 'workspaces' argument containing path-traversal sequences; the manipulated workspace path then escapes the intended directory to overwrite or delete files. Limiting factors: it is not triggered by a passive/default run - it needs the fix behavior to be invoked (UI:P) and an attacker-influenced configuration or repository to be processed, so it is a developer-workstation/supply-chain exposure rather than a service-facing remote flaw. Precisely how the writeFile routine resolves the traversal beyond the manipulated workspaces argument is not detailed in the available sources.

This is a modest-severity (CVSS 4.0 base 5.3, MEDIUM) path-traversal issue (CWE-22) in Knip, a developer CLI for finding unused files/exports/dependencies, specifically in the writeFile logic of its IssueFixer (autofix) component. The signals point to low real-world urgency rather than an emergency: EPSS is not provided, the issue is NOT on CISA KEV, SSVC/decision labeling from vuln.today is 'this_month' (not act_now/emergency), and a public PoC reference exists but is not verified as working exploit code. The supplied CVSS 4.0 vector asserts network attack vector (AV:N) with required user interaction (UI:P) and low impact across confidentiality, integrity and availability. The AV:N claim conflicts with the nature of the product: Knip is a local developer tool that operates on a project's workspaces configuration, so 'remote' realistically means an attacker-supplied repository/config that a victim then processes locally - verify the attack-vector assumption rather than treating AV:N as true network-service exposure. Overall this reads as a genuine but low-priority developer-supply-chain hygiene issue, not a widely weaponizable remote flaw.

An attacker publishes or contributes a repository whose Knip configuration sets a crafted 'workspaces' value containing path-traversal sequences; when a developer runs Knip's autofix mode, the IssueFixer writeFile routine resolves the manipulated workspace path and writes/overwrites or deletes files outside the intended workspace directory. The referenced PoC (titled 'Knip Workspaces Config Path Traversal File Deletion Overwrite') describes this file deletion/overwrite behavior, but it is a reference only and not verified as working exploit code; exploitation requires user interaction (UI:P), namely the victim running the tool against the attacker-influenced configuration.